CVE-2026-109284 | Open WebUI up to 0.11.3 Chat Fork /api/v1/chats/{id}/fork chat fork handler id improper authorization

October 12, 2026 Yanac

A vulnerability described as critical has been identified in Open WebUI up to 0.11.3. This issue affects the function chat fork handler of the file /api/v1/chats/{id}/fork of the component Chat Fork Handler. Executing a manipulation of the argument ID can lead to improper authorization.

This vulnerability appears as CVE-2026-109284. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More